GDPR and HIPAA: How These Two Laws Compare and Overlap

GDPR and HIPAA are two of the most referenced data protection regulations in the world, but they serve different purposes and apply to different organizations. If your business handles health-related data, particularly across borders, understanding how GDPR and HIPAA interact is critical for staying compliant with both frameworks.

This guide breaks down the key differences and overlaps between HIPAA and GDPR, explains when both laws apply simultaneously, and outlines practical steps for compliance. This content is educational and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.

What Are GDPR and HIPAA?

Before comparing the two laws, it helps to understand what each one does on its own.

The GDPR

The General Data Protection Regulation (GDPR) is an EU regulation that took effect on May 25, 2018. It governs how organizations collect, store, process, and transfer the personal data of individuals located in the European Economic Area (EEA). The GDPR applies to any organization worldwide that processes EEA residents' personal data, regardless of where the organization is located.

The GDPR is codified in Regulation (EU) 2016/679 and enforced by national Data Protection Authorities (DPAs) in each EU member state. Penalties for non-compliance can reach up to 20 million EUR or 4% of annual global turnover, whichever is higher, under Article 83(5).

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law enacted in 1996. Its Privacy Rule (45 CFR Part 164, Subpart E) and Security Rule (45 CFR Part 164, Subpart C) regulate how covered entities and their business associates handle protected health information (PHI).

HIPAA applies to three categories of organizations:

• Health plans: Insurance companies, HMOs, government health programs
• Healthcare providers: Doctors, clinics, hospitals, pharmacies that transmit health information electronically
• Healthcare clearinghouses: Entities that process nonstandard health information into standard formats

Business associates, meaning third parties that handle PHI on behalf of covered entities, are also bound by HIPAA through Business Associate Agreements (BAAs).

Key Differences Between GDPR and HIPAA

While both laws protect sensitive data, GDPR and HIPAA differ in scope, structure, and requirements. Understanding these differences is essential for organizations that must comply with both.

Scope and applicability

The most fundamental difference is who each law protects and what data it covers.

• GDPR protects all personal data of EU/EEA residents, including names, email addresses, IP addresses, location data, and any information that can identify a natural person. It applies to any organization processing this data, worldwide.
• HIPAA protects only protected health information (PHI) and applies only to covered entities and business associates in the U.S. healthcare system. PHI includes 18 specific identifiers (name, address, dates, Social Security number, medical record numbers, and others) when linked to health information.

Legal basis for processing

The GDPR requires organizations to establish a legal basis for processing personal data under Article 6. For health data specifically, Article 9 applies, which generally prohibits processing "special category data" unless one of ten explicit exceptions is met, such as explicit consent or necessity for healthcare provision.

HIPAA does not use a consent-based framework in the same way. Covered entities may use and disclose PHI for treatment, payment, and healthcare operations without patient authorization. A signed authorization is required for most other uses, but the standard is different from the GDPR's explicit consent requirement.

Individual rights

Both laws grant individuals rights over their data, but the GDPR provides a broader set:

Right	GDPR	HIPAA
Access to data	Article 15: right to obtain a copy of all personal data	45 CFR 164.524: right to inspect and obtain a copy of PHI
Correction	Article 16: right to rectification	45 CFR 164.526: right to request amendment
Deletion	Article 17: right to erasure ("right to be forgotten")	No equivalent right
Data portability	Article 20: right to receive data in machine-readable format	Limited: electronic copy right under HITECH Act
Restrict processing	Article 18: right to restrict processing	45 CFR 164.522: right to request restrictions (limited)
Object to processing	Article 21: right to object	No equivalent right

The right to erasure is one of the starkest contrasts. Under the GDPR, individuals can request deletion of their personal data in many circumstances. HIPAA has no equivalent right because healthcare records must be retained for regulatory, treatment, and legal purposes.

Breach notification

Both laws require breach notification, but the timelines and thresholds differ significantly.

• GDPR (Article 33): Organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights. If the breach is likely to result in a high risk, affected individuals must also be notified without undue delay under Article 34.
• HIPAA (45 CFR 164.404-408): Covered entities must notify affected individuals within 60 days of discovering a breach of unsecured PHI. If the breach affects 500 or more individuals, the covered entity must also notify the HHS Secretary and prominent media outlets within the same 60-day window. Breaches affecting fewer than 500 individuals can be reported annually.

Penalties

• GDPR: Up to 20 million EUR or 4% of annual global turnover under Article 83(5), whichever is higher
• HIPAA: Tiered penalties under 42 USC 1320d-5, ranging from $137 to $68,928 per violation, with annual caps up to $2,067,813 per violation category (amounts adjusted annually for inflation). Criminal penalties under 42 USC 1320d-6 can reach $250,000 and 10 years imprisonment for intentional violations.

When Both GDPR and HIPAA Apply

Organizations can be subject to both HIPAA and GDPR simultaneously. This dual applicability creates compliance complexity that requires careful planning.

Common scenarios

Both laws apply when:

1. A U.S. healthcare provider treats EU patients: A hospital in the United States that provides telehealth services to patients in Germany processes PHI under HIPAA and personal data (including health data) under the GDPR
2. A health technology company serves both markets: A SaaS company providing electronic health records to clinics in the U.S. and the EU must comply with HIPAA as a business associate and the GDPR as a data processor
3. Clinical research across borders: Pharmaceutical companies conducting clinical trials in both the U.S. and EU must comply with both frameworks for participant data
4. Employee health programs: A multinational corporation with employees in both the U.S. and EU that administers health benefits may trigger both laws

Which law takes precedence?

Neither law overrides the other. When both apply, the organization must meet the requirements of each independently. In practice, this means applying the stricter standard where the two laws diverge. For example, since the GDPR requires breach notification within 72 hours and HIPAA allows 60 days, an organization subject to both must meet the 72-hour GDPR deadline.

Where GDPR and HIPAA Overlap

Despite their differences, GDPR and HIPAA share several core principles. Organizations already compliant with one law have a foundation for meeting the other.

Shared principles

• Data minimization: Both laws encourage limiting data collection and use to what is necessary. The GDPR makes this an explicit principle under Article 5(1)(c). HIPAA's "minimum necessary" standard under 45 CFR 164.502(b) achieves a similar outcome.
• Security safeguards: Both require technical and organizational measures to protect data. The GDPR mandates "appropriate technical and organizational measures" under Article 32. HIPAA's Security Rule specifies administrative, physical, and technical safeguards under 45 CFR 164.308-312.
• Risk assessments: The GDPR requires Data Protection Impact Assessments (DPIAs) under Article 35 for high-risk processing. HIPAA requires risk analyses under 45 CFR 164.308(a)(1)(ii)(A).
• Third-party accountability: The GDPR requires data processing agreements under Article 28. HIPAA requires Business Associate Agreements under 45 CFR 164.502(e).
• Documentation: Both laws require organizations to maintain records of their data processing activities and compliance measures.

Building on existing compliance

If your organization already complies with HIPAA, you have a meaningful head start on GDPR compliance. The security controls, risk assessments, and third-party management practices required by HIPAA map to many GDPR requirements. However, you will need to address the gaps, particularly around consent, data subject rights, cross-border transfers, and the broader scope of "personal data" versus "PHI."

How to Comply With Both GDPR and HIPAA

Achieving dual compliance requires a structured approach. The following steps address the most critical requirements of both regulations.

1. Map your data flows

Identify what personal data and PHI you collect, where it is stored, how it moves between systems, and who has access. This exercise satisfies the GDPR's record of processing activities requirement (Article 30) and supports HIPAA's risk analysis requirement.

2. Establish legal bases

For GDPR compliance, document the legal basis for every processing activity involving EU residents' data. Health data requires meeting both Article 6 (general legal basis) and Article 9 (special category data) conditions. For HIPAA, verify that each use and disclosure of PHI falls within permitted uses or is covered by a valid authorization.

3. Implement a unified privacy policy

Your privacy policy generator output should address both frameworks. A comprehensive privacy policy needs to cover:

• Categories of personal data and PHI collected
• Legal bases for processing (GDPR) and permitted uses (HIPAA)
• Individual rights under both laws and how to exercise them
• Data retention periods
• Cross-border transfer mechanisms
• Contact information for your Data Protection Officer (if required) and HIPAA Privacy Officer

4. Deploy appropriate security controls

Implement technical measures that satisfy both frameworks:

• Encryption of data at rest and in transit
• Access controls and authentication
• Audit logging and monitoring
• Incident response procedures
• Regular security assessments
• Workforce training on both GDPR and HIPAA requirements

5. Prepare for breach response

Create a unified breach response plan that meets the stricter timeline. Since the GDPR's 72-hour notification requirement is more demanding than HIPAA's 60-day window, design your incident response around the shorter deadline. Ensure you can notify the appropriate supervisory authority, HHS, affected individuals, and media (if required by HIPAA) within the applicable timeframes.

6. Execute data processing agreements

Every third party that handles personal data or PHI needs a written agreement. For GDPR, this is a data processing agreement under Article 28. For HIPAA, this is a Business Associate Agreement. Many organizations use a combined agreement that satisfies both requirements.

International Data Transfers Under GDPR and HIPAA

Cross-border data transfers present a particular challenge when GDPR and HIPAA intersect.

GDPR transfer mechanisms

The GDPR restricts transfers of personal data outside the EEA unless the receiving country has an adequate level of data protection or an appropriate safeguard is in place. For transfers to the United States, the EU-U.S. Data Privacy Framework (DPF) provides an adequacy mechanism for certified organizations. Organizations not certified under the DPF must rely on Standard Contractual Clauses (SCCs) under Article 46(2)(c) or Binding Corporate Rules under Article 47.

HIPAA and cross-border transfers

HIPAA does not explicitly restrict cross-border data transfers. However, covered entities and business associates remain responsible for PHI regardless of where it is stored or processed. If PHI is transferred internationally, the entity must ensure the receiving party maintains HIPAA-compliant safeguards, typically through a Business Associate Agreement.

Practical approach

Organizations subject to both laws should:

• Use Standard Contractual Clauses or the DPF for GDPR-covered transfers to the U.S.
• Execute Business Associate Agreements with all parties that access PHI
• Conduct Transfer Impact Assessments as required by the GDPR to evaluate whether the legal framework in the receiving country provides adequate protection
• Consider data localization for particularly sensitive categories where feasible

Common Mistakes When Navigating GDPR and HIPAA

Organizations frequently make errors when trying to comply with both regulations. Avoiding these pitfalls saves time, money, and legal exposure.

Assuming HIPAA compliance covers the GDPR

This is the most common mistake. HIPAA compliance does not satisfy GDPR requirements. The GDPR is broader in scope, covers more data types, grants more individual rights, and imposes stricter consent requirements. Treat them as separate but overlapping obligations.

Ignoring the GDPR's broader definition of personal data

HIPAA's definition of PHI is tied to health information linked to 18 specific identifiers. The GDPR's definition of personal data is far broader, covering any information that can directly or indirectly identify a natural person. IP addresses, cookie identifiers, and device fingerprints all qualify as personal data under the GDPR. If your website uses cookies or tracking technologies, you need a compliant cookie policy generator to address this.

Overlooking employee data

Organizations that focus exclusively on patient or customer data may forget that employee data is also covered. The GDPR applies to employee personal data, and since the CPRA amendments removed the employee data exemption from the CCPA, U.S. organizations may face additional obligations for their workforce data.

Neglecting data subject access requests

Both laws grant individuals the right to access their data, but the GDPR's one-month response deadline (Article 12(3)) is significantly shorter than HIPAA's 30-day window (with a possible 30-day extension). Organizations need systems that can locate and compile data from all sources within these timeframes.

Frequently Asked Questions

Does GDPR apply to healthcare organizations in the United States?

Yes. If a U.S. healthcare organization processes the personal data of individuals located in the European Economic Area, it must comply with the GDPR regardless of where the organization is based. This applies when offering services to EU residents, monitoring their behavior, or processing their health data in any capacity covered by Article 3 of the GDPR.

Can you be subject to both GDPR and HIPAA at the same time?

Yes. An organization can be subject to both laws simultaneously. For example, a U.S. hospital that treats patients from EU countries must comply with HIPAA for its domestic operations and with the GDPR for any personal data it processes belonging to EU residents. Dual compliance requires meeting the stricter standard where the two laws diverge.

What is the main difference between GDPR and HIPAA?

The main difference is scope. HIPAA applies only to covered entities and business associates in the U.S. healthcare system and protects only protected health information (PHI). The GDPR applies to any organization worldwide that processes personal data of EU residents and covers all categories of personal data, not just health records.

Do HIPAA-compliant organizations automatically comply with the GDPR?

No. HIPAA compliance does not satisfy GDPR requirements. The GDPR imposes additional obligations that HIPAA does not address, including explicit consent requirements for health data under Article 9, the right to data portability, the right to erasure, mandatory Data Protection Impact Assessments, and the appointment of a Data Protection Officer in certain cases.